iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad and iOS Devices

327 Pages·2011·8.79 MB·English

by  Andrew Hoog

iPhone and iOS
Forensics
This page intentionally left blank
iPhone and iOS
Forensics
Investigation, Analysis
and Mobile Security for Apple
iPhone, iPad, and iOS Devices
Andrew Hoog
Katie Strzempka
Technical Editor
Robert Maxwell
AcquiringEditor:AngelinaWard
DevelopmentEditor:HeatherScherer
ProjectManager:JessicaVaughan
Designer:EricDeCicco
SyngressisanimprintofElsevier
225WymanStreet,Waltham,MA02451,USA
#2011Elsevier,Inc.Allrightsreserved.
Nopartofthispublicationmaybereproducedortransmittedinanyformorbyanymeans,
electronicormechanical,includingphotocopying,recording,oranyinformationstorageand
retrievalsystem,withoutpermissioninwritingfromthepublisher.Detailsonhowtoseek
permission,furtherinformationaboutthePublisher’spermissionspoliciesandour
arrangementswithorganizationssuchastheCopyrightClearanceCenterandtheCopyright
LicensingAgency,canbefoundatourwebsite:www.elsevier.com/permissions.
Thisbookandtheindividualcontributionscontainedinitareprotectedundercopyrightby
thePublisher(otherthanasmaybenotedherein).
Notices
Knowledgeandbestpracticeinthisfieldareconstantlychanging.Asnewresearchand
experiencebroadenourunderstanding,changesinresearchmethodsorprofessionalpractices,
maybecomenecessary.Practitionersandresearchersmustalwaysrelyontheirown
experienceandknowledgeinevaluatingandusinganyinformationormethodsdescribed
herein.Inusingsuchinformationormethodstheyshouldbemindfuloftheirownsafetyand
thesafetyofothers,includingpartiesforwhomtheyhaveaprofessionalresponsibility.
Tothefullestextentofthelaw,neitherthePublishernortheauthors,contributors,oreditors,
assumeanyliabilityforanyinjuryand/ordamagetopersonsorpropertyasamatterofproducts
liability,negligenceorotherwise,orfromanyuseoroperationofanymethods,products,
instructions,orideascontainedinthematerialherein.
LibraryofCongressCataloging-in-PublicationData
Hoog,Andrew.
iPhoneandiOSforensics:investigation,analysis,andmobilesecurityforAppleiPhone,
iPad,andiOSdevices/AndrewHoog,KatieStrzempka.
p.cm.
Includesindex.
ISBN978-1-59749-659-9
1. iPhone(Smartphone)2. iPad(Computer)3. iOS(Electronicresource)4. Datarecovery
(Computerscience) I.Strzempka,Katie.II.Title.
QA76.8.I64H6652011
005.8’6–dc23
2011013050
BritishLibraryCataloguing-in-PublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary.
ISBN:978-1-59749-659-9
PrintedintheUnitedStatesofAmerica
11 12 13 14 15 10 9 8 7 6 5 4 3 2 1
ForinformationonallSyngresspublicationsvisitourwebsiteatwww.syngress.com
Contents
Acknowledgments.................................................................................................. ix
Preface.................................................................................................................... xi
About the Authors............................................................................................... xiii
About the Technical Editor................................................................................... xv
CHAPTER 1 Overview.............................................................................1
Introduction.................................................................................1
Strategy....................................................................................2
Development community........................................................2
iPhone Models.............................................................................4
iPhone hardware......................................................................5
Forensic Examination Approaches.............................................8
iPhone leveling......................................................................10
Acquisition types...................................................................12
Forensics with Linux.............................................................15
CHAPTER 2 Device features and functions............................................35
Introduction...............................................................................35
Apple Device Overview............................................................35
Operating Modes.......................................................................37
Normal mode.........................................................................37
Recovery mode......................................................................37
DFU mode.............................................................................37
Exiting Recovery/DFU mode................................................41
Security......................................................................................42
Device settings.......................................................................42
Secure erase...........................................................................43
App security...........................................................................44
iTunes Interaction......................................................................44
Device Synchronization.........................................................44
iPhone backups......................................................................45
iPhone restore........................................................................46
iPhone iOS updates...............................................................46
Upgrade..................................................................................46
Downgrade.............................................................................47
The App Store.......................................................................52
MobileMe...............................................................................52
v
vi Contents
CHAPTER 3 File system and data storage..............................................55
Introduction...............................................................................55
What Data is Stored..................................................................55
Where Data is Stored................................................................56
How Data is Stored...................................................................59
Internal storage......................................................................59
SQLite database files.............................................................60
Property lists..........................................................................62
Network..................................................................................65
Memory Types..........................................................................65
RAM......................................................................................65
NAND Flash..........................................................................66
iPhone Operating System..........................................................70
iOS layers..............................................................................70
File System................................................................................71
Volumes.................................................................................74
Journaling...............................................................................74
iPhone disk partitions............................................................75
CHAPTER 4 iPhone and iPad data security............................................79
Introduction...............................................................................79
Data Security and Testing.........................................................80
Computer crime laws in the United States...........................80
Data protection in the hands of the administrators..............82
Security testing procedure.....................................................85
Application Security..................................................................93
Corporate or individual mobile app consumers...................94
Corporate or individual mobile app developers...................96
Application security strategies for developers.....................97
Recommendations for Device and Application Security.......101
CHAPTER 5 Acquisitions....................................................................107
Introduction.............................................................................107
iPhone Forensics Overview....................................................107
Types of investigations.......................................................108
Difference between logical and physical techniques.........109
Modification of the target device.......................................109
Handling Evidence..................................................................111
Passcode procedures............................................................111
Network isolation................................................................111
Powered-off devices............................................................112
Imaging an iPhone/iPad..........................................................112
Backup acquisition..............................................................112
Contents vii
Logical acquisition..............................................................119
Physical acquisition.............................................................120
Imaging Other Apple Devices................................................133
iPad......................................................................................133
iPod Touch...........................................................................134
Apple TV.............................................................................134
CHAPTER 6 Data and application analysis..........................................137
Introduction.............................................................................137
Analysis Techniques...............................................................137
Mount disk image................................................................137
File carving..........................................................................138
Strings..................................................................................144
Timeline development and analysis....................................146
Forensic analysis.................................................................153
iPhone Data Storage Locations...............................................159
Default applications.............................................................160
Downloaded apps................................................................167
Other....................................................................................170
iPhone Application Analysis and Reference..........................178
Default applications.............................................................178
Third-party (downloaded) applications...............................201
CHAPTER 7 Commercial tool testing...................................................213
Introduction.............................................................................213
Data Population.......................................................................214
Analysis Methodology............................................................218
CelleBrite UFED.....................................................................220
Installation...........................................................................221
Forensic acquisition.............................................................222
Results and reporting...........................................................222
iXAM.......................................................................................228
Installation...........................................................................229
Forensic acquisition.............................................................229
Results and reporting...........................................................230
Oxygen Forensic Suite 2010...................................................234
Installation...........................................................................236
Forensic acquisition.............................................................236
Results and reporting...........................................................237
XRY.........................................................................................239
Installation...........................................................................242
Forensic acquisition.............................................................242
Results and reporting...........................................................242
viii Contents
Lantern.....................................................................................245
Installation...........................................................................248
Forensic acquisition.............................................................248
Results and reporting...........................................................248
MacLock Pick.........................................................................251
Installation...........................................................................253
Forensic acquisition.............................................................254
Results and reporting...........................................................254
Mobilyze..................................................................................255
Installation...........................................................................257
Forensic acquisition.............................................................257
Results and reporting...........................................................257
Zdziarski Technique................................................................260
Installation...........................................................................263
Forensic acquisition.............................................................263
Results and reporting...........................................................263
Paraben Device Seizure..........................................................266
Installation...........................................................................268
Forensic acquisition.............................................................268
Results and reporting...........................................................269
MobileSyncBrowser................................................................272
Installation...........................................................................273
Forensic acquisition.............................................................273
Results and reporting...........................................................274
CellDEK..................................................................................275
Installation...........................................................................276
Forensic acquisition.............................................................278
Results and reporting...........................................................278
EnCase Neutrino.....................................................................279
Installation...........................................................................281
Forensic acquisition.............................................................282
Results and reporting...........................................................282
iPhone Analyzer......................................................................285
Installation...........................................................................287
Forensic acquisition.............................................................287
Results and reporting...........................................................287
Appendix A.............................................................................................. 291
Appendix B.............................................................................................. 293
Appendix C.............................................................................................. 295
Index.................................................................................................................... 303
Acknowledgments
Whenmakingthedecisiontoco-authorthisbook,Iwaswellawareoftheimpactit
was going to have on my life, but did not fully realize all of the others that would
be directly or indirectly involved. Luckily, I have this section to show my
appreciation.
I must first thank my family and friends for being so understanding on those
many nights and weekends where I was M.I.A. Specifically...thanks to my dad
for editing Chapter 2, even though “the Linux stuff was kind of way over my
head,” and to my mom for always trying to convince me that I am way smarter
than I actually am. Thank you to my brother, Danny, for caring for my dog when
I was unable to. Jill, thank you for your encouragement throughout the entire pro-
cess,especiallywhenitinvolvedcupcakesfilledwithcookiedough.Anadditional
thank you to my friends for convincing me to take occasional breaks to eat sushi
and play darts.
To Dr. Marcus Rogers and Purdue’s Cyber Forensics program: thank you for
helping me prepare for a career in this field and to continue to advise me on pro-
fessional decisions.
IalsooweagreatdealofgratitudetotheviaForensicsfolks,mainlyforputting
upwithAndrewandmyconstanttalkofthe“wordcountmeter.”BigthankstoTed
forhisabilitytoconcatenatemyiPhonesimulatorphotos,Catherineforlettingme
ventonadailybasis,andChrisforforcingmetoinventnewwaysofanalyzingthe
iPhone, even when I laughed at him and said, “there is NO WAY we can recover
those videos!”
This book would not have been completed without the help of my co-author,
Andrew Hoog, who has taught me that everything can and should be done using
command line (even if there is a GUI that can do it 10 times faster).
ix